# Publish to enzim Apps

For developers and coding agents. Public-source apps only. Production publication
always requires manual review and separate enzim signing.

1. Sign in at https://flatpak.enzim.dev/dashboard.html and connect the public
   repository. In Automatic builds, prepare setup, review the two proposed files,
   then enable the changes. GitHub's existing branch protections still apply.
2. Add a self-contained JSON Flatpak manifest. Use a Git source pointing at your
   public GitHub repository, with `"commit": "@ENZIM_SOURCE_COMMIT@"` and
   `"disable-submodules": true`. The trusted builder replaces this placeholder
   with the exact selected release commit. This avoids a self-referential Git
   commit hash in a manifest stored in the same repository.
3. Pin every other Git dependency to a full commit; file/archive sources need
   SHA-256. Expand external module includes. Do not use local path sources,
   undeclared downloads, extra-data, host build arguments or network during
   compilation. Current builder supports Freedesktop, GNOME and KDE runtimes
   from Flathub. Dependencies/submodules must be explicitly declared.
4. Create a GitHub release. Select it in the dashboard, complete the listing,
   licence/privacy/access information, icon and screenshots, and submit.
   Enabled repositories start a build automatically. Missing packaging can be
   submitted for human help but cannot build until a new packaged release exists.
5. Track the build and manual review in the dashboard. A verified build records
   exact source, manifest, builder and package identity. Build success is not
   publication approval. Fixes/new releases create new immutable submissions.

## Machine access

Contract: https://flatpak.enzim.dev/developer-api/contract

CLI: https://flatpak.enzim.dev/enzim-store.py (Python 3 standard library only).
Download and inspect it, then run `python3 enzim-store.py --help`. Generate a
repository-scoped agent token under Automatic builds → Coding agent access.
It expires with the issuing browser session (maximum eight hours), is invalidated
by sign-out and cannot perform reviewer operations. Never include it in a repo,
prompt log, issue, build manifest or command-line argument.

```sh
python3 enzim-store.py auth --token-stdin < /private/agent-token
python3 enzim-store.py repositories
python3 enzim-store.py setup --repository 123
# Review returned files/change before explicitly confirming the merge:
python3 enzim-store.py setup --repository 123 --confirm
python3 enzim-store.py selection --repository 123 --release 456
python3 enzim-store.py draft --repository 123 --release 456 --app-id io.github.owner.App > /private/submission.json
python3 enzim-store.py upload --kind icon /path/icon.png
python3 enzim-store.py upload --kind screenshot /path/screenshot.png
python3 enzim-store.py submit /path/submission.json
python3 enzim-store.py build --submission SUBMISSION_ID
python3 enzim-store.py status --submission SUBMISSION_ID
```

The draft command prefills source/release/listing fields; fill missing values,
replace upload IDs and explicitly set public_consent after review. The contract
includes the submission schema.

Use `--credentials /private/session.json` to choose the private credential file,
or set `ENZIM_STORE_TOKEN` in the agent's environment. Responses are JSON;
failures include an error/code and, where available, next_action. HTTP errors
return a nonzero exit status. The contract lists endpoints for existing forms.

## Optional app settings

Configure these directly in your repository, never through the store:

```sh
gh secret set ENZIM_BUILD_CONFIG --repo OWNER/REPO < /private/settings.json
```
JSON maps scalar `ENZIM_*` names to app-specific values, for example
`{"ENZIM_TELEGRAM_API_ID":"...","ENZIM_TELEGRAM_API_HASH":"..."}`. The app build
must consume those environment variables explicitly. Values stay in your own GitHub Actions secrets. The enzim App has no Secrets
permission; the dashboard and Store CLI do not accept them. Treat values embedded into the distributed app as extractable. Backend
credentials and signing keys must not be embedded in apps or supplied here.

The builder and attestation jobs are separate. The latter receives no app
configuration and executes no app source. Artifact verification and human review
are separate from both developer CI and private release signing.